[PATCH 1/2] doc: LSM: describe CONFIG_LSM and lsm= as the selection mechanism

[Paul Moore]

On Jul 13, 2026 Lincoln Wallace <locnnil0 at gmail.com> wrote:
> 
> The LSM usage document states that security modules are selectable at
> build time via CONFIG_DEFAULT_SECURITY and can be overridden at boot
> time via the "security=..." kernel command line argument.
> 
> CONFIG_DEFAULT_SECURITY no longer exists: LSMs are enabled via
> CONFIG_LSM, an ordered list of the LSMs to initialize, which can be
> overridden at boot time with the "lsm=" parameter. The "security="
> parameter remains as a deprecated way to choose a legacy "major"
> security module, and is ignored when "lsm=" is specified; see commit
> 89a9684ea158 ("LSM: Ignore "security=" when "lsm=" is specified").
> 
> A previous attempt replaced "security=" with "lsm=" in place [1],
> which was rejected because the parameters are not equivalent:
> "security=" selects a single major module while the built-in
> CONFIG_LSM list otherwise remains active, whereas "lsm=" must list
> every LSM to enable.
> 
> Update the paragraph to describe CONFIG_LSM and "lsm=" as the current
> selection mechanism, keeping "security=" documented as the deprecated
> legacy option, matching the wording in kernel-parameters.txt.
> 
> Link: https://lore.kernel.org/r/20250114225156.10458-1-rdunlap@infradead.org [1]
> 
> Signed-off-by: Lincoln Wallace <locnnil0 at gmail.com>
> ---
>  Documentation/admin-guide/LSM/index.rst | 8 +++++---
>  1 file changed, 5 insertions(+), 3 deletions(-)

Merged into lsm/dev, thanks!

--
paul-moore.com